Use message/stream for long-running agent requests. Synchronous message/send requests that do not produce a response within about 30 seconds can be terminated by the external CDN before Rovo finishes.

Request path

1
2
A2A client
  -> Atlassian OAuth
  -> A2A Gateway /v1/rovo
  -> organization and Rovo access checks
  -> downstream Rovo service
  -> Rovo tools for Jira, Confluence, and other Atlassian products
  -> JSON-RPC response or SSE events

Prerequisites

Before testing, confirm:

The organization administrator has enabled A2A.
Rovo is enabled for the selected site.
AI-enabled apps and any Generative AI access policy allow the test user.
The test user has access to the Jira or Confluence data used in the prompt.
Your client supports OAuth 2.0 authorization code flow with PKCE.
You have curl, jq, openssl, and uuidgen available.

The required OAuth scopes are:

1
2
read:me offline_access full_access:chat:rovo

Endpoints

Purpose	Production URL
Agent Card	`https://a2a.atlassian.com/.well-known/agent.json`
Protected resource metadata	`https://a2a.atlassian.com/.well-known/oauth-protected-resource/v1/rovo`
JSON-RPC endpoint	`https://a2a.atlassian.com/v1/rovo`

Do not hardcode authorization endpoints. Read them from the discovery documents above.

Step 1: Verify discovery

1
2
BASE_URL=https://a2a.atlassian.com

curl -fsS "$BASE_URL/.well-known/agent.json" | jq .
curl -fsS "$BASE_URL/.well-known/oauth-protected-resource/v1/rovo" | jq .

Confirm that:

The Agent Card returns HTTP 200.
protocolVersion matches the version your client implements.
capabilities.streaming is true before using message/stream.
The card advertises OAuth and a JSON-RPC URL ending in /v1/rovo.

Step 2: Complete OAuth

Use the Dynamic Client Registration and OAuth endpoints returned by discovery. Register a public client with PKCE. Then complete authorization in a browser and exchange the code for an access token.

Do not copy tokens into logs, tickets, or chat messages. Store refresh tokens as secrets.

Step 3: Send a streaming request

The current 0.3 implementation requires kind discriminators and UUID message identifiers.

1
2
REQUEST_ID=$(uuidgen | tr '[:upper:]' '[:lower:]')
MESSAGE_ID=$(uuidgen | tr '[:upper:]' '[:lower:]')

curl -sS -N --max-time 240 \
  -X POST "$BASE_URL/v1/rovo" \
  -H 'Content-Type: application/json' \
  -H 'Accept: text/event-stream' \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data "{
    \"jsonrpc\": \"2.0\",
    \"id\": \"$REQUEST_ID\",
    \"method\": \"message/stream\",
    \"params\": {
      \"message\": {
        \"kind\": \"message\",
        \"messageId\": \"$MESSAGE_ID\",
        \"role\": \"user\",
        \"parts\": [
          {
            \"kind\": \"text\",
            \"text\": \"What Jira issues are assigned to me? Return the first three issue keys and summaries.\"
          }
        ]
      }
    }
  }"

The request passes if it returns:

HTTP 200 and Content-Type: text/event-stream.
An SSE comment before the connection becomes idle.
JSON-RPC artifact or status update events.
A terminal status update with state completed.
A response that reflects the authenticated user's Atlassian permissions.

Step 4: Check synchronous behavior

message/send returns one JSON document and cannot carry SSE heartbeat comments. A short request may complete successfully. A tool-heavy request can exceed the external 30-second response budget while Rovo continues processing downstream.

Do not use a single fast message/send request as the only release check. Include a streaming tool call in every validation run.

Troubleshooting

Symptom	Likely cause	Action
HTTP 401	Missing, expired, or invalid OAuth token	Repeat OAuth or refresh the token.
HTTP 403 before Rovo	A2A is disabled or the site-owning organization cannot be resolved	Check the organization A2A setting and selected site.
HTTP 403 from Rovo	Rovo AI access is denied for the user	Check Rovo access, AI-enabled apps, and Generative AI access policy.
Parse error	The request uses `type` instead of `kind`	Use `message.kind` and `parts[].kind`.
Invalid UUID error	`messageId` is not a UUID	Generate message IDs with `uuidgen`.
Stream closes before data	TTFB, heartbeat, proxy, or downstream failure	Capture the response trace ID and provide it to Atlassian support.
Edge HTTP 500 at about 30 seconds	A synchronous request produced no response bytes before the CDN timeout	Use `message/stream`; `message/send` cannot send heartbeat data before the response is complete.

Validation checklist

Run these checks before every release:

Run discovery and complete the OAuth flow.
Run message/stream with a real Jira or Confluence tool call.
Confirm a terminal event and save the trace ID.
Test one fast and one tool-heavy message/send request. The fast request must return a completed task. The tool-heavy request either completes or returns an HTTP 500 at roughly 30 seconds; that 500 is expected CDN behaviour rather than a gateway defect, and the same request must succeed when sent with message/stream.
Verify the Agent Card protocol version and capabilities.
Confirm errors are not persisting, and provide a trace ID to Atlassian support if they are.

Protocol upgrades

The gateway and the downstream Rovo service must upgrade together. Protocol upgrades can affect discovery, JSON-RPC schemas and methods, authentication metadata, task models, content types, and stream events.

For A2A 1.0, review the official specification and 0.3 to 1.0 changes before implementation. Keep a compatibility plan for existing 0.3 clients and test both versions during rollout.